Privacy Policy

1. Who We Are and What This Policy Covers

This Privacy Policy explains how MetaSys collects, uses, shares, and protects personal data when you visit www.metasysltd.com, send us an enquiry, apply for a job, subscribe to our newsletter, or book a call with us. MetaSys is the brand name used by METASYS SOLUTIONS LLC (United States) and its affiliated companies METASYS SOLUTIONS PRIVATE LIMITED and METASYS LOGISTICS PRIVATE LIMITED (Pakistan), together referred to as "MetaSys", "we", "us", or "our". We provide AI transformation, software engineering, global capability center, and logistics services to businesses.

1.1 Data Controller

The controller responsible for personal data collected through this website is METASYS SOLUTIONS LLC, 30738 Wicklow Gardens Dr, Fulshear, TX 77441, USA. This applies to visitors in every country, including the United Kingdom and the European Union. Our affiliated companies in Pakistan access personal data on our behalf when they help us respond to enquiries and deliver services. You can reach us about any data protection matter at hello@metasysltd.com.

This policy is information about how we handle personal data. It is not a contract, and you do not accept it simply by using our website. Where we rely on your consent, for example for analytics or marketing cookies or for SMS and WhatsApp messages, we ask for it separately and you can withdraw it at any time.

2. Information We Collect

2.1 Information You Give Us

What we collect depends on the form you use. Fields marked as required are needed for us to respond; everything else is optional.

• Contact and consultation forms: name, email address, phone or WhatsApp number, company name, company size, the service you are interested in, how you heard about MetaSys, and your message.
• Logistics enquiry forms, quizzes and calculators: name, email address, phone number, company name, your operating authority (MC/DOT) status, and a summary of the answers you chose to send us.
• Proposal requests: company name, contact name, email address, phone number, company website, project type, budget range, timeline, project description, and any document you upload.
• Newsletter signups: your email address.
• Your choices: whether you ticked the optional SMS/WhatsApp consent box and the required privacy acknowledgment.

With every form submission we also record which form and page it came from, the time, the marketing source details described in Section 2.3, your approximate country (derived from your IP address by our hosting provider), your device type (mobile, tablet or desktop), and the spam score returned by Google reCAPTCHA.

2.2 Job Applicants

When you apply through our Careers page we collect your name, email address, phone number, the role you are applying for, your cover note, and your CV (PDF or DOCX). Please do not include sensitive information in your CV, such as health details, religious beliefs, or ethnic origin. We do not need it to assess your application.

2.3 Information Collected Automatically

• First-party, cookieless site statistics. Our own servers count page views per day, the landing page of each visit, the referring website, campaign (utm) tags, approximate country, device type, and clicks on key buttons such as "Book a call". To estimate the number of unique visitors, we combine your IP address and browser user agent with a secret value that changes every day and turn them into a one-way hash. The secret value is never stored, so the hash cannot be reversed or linked across days, and your IP address is not stored for statistics. No cookie or other identifier is placed on your device for this. If your browser sends a Global Privacy Control or Do Not Track signal, we do not record these statistics for your visit at all.
• Marketing source of an enquiry. If you arrive from an ad or a tagged link and send us a form on that same page, we record the campaign tags and ad click identifier (such as Google's gclid) from that page's address with your enquiry. If you have accepted analytics or marketing cookies, a session cookie (ms_attr, see Section 5) carries the same details from page to page, so an enquiry sent later in your visit is still attributed to the right source.
• Vercel Web Analytics and Speed Insights. Our hosting provider measures page views and page load performance (page, referring site, country, device and browser type, timing data) without cookies.
• Security data. Our servers and hosting provider process your IP address and browser details to deliver pages, limit how many form submissions can come from one address, and block attacks.
• Analytics and marketing cookies, only with your consent: Google Analytics 4, Microsoft Clarity, and Google Ads conversion measurement. See Section 5.

2.4 Information From Third Parties

• Calendly: when you book a consultation, Calendly passes us your name, email address, the time you chose, any answers you give in the booking form, and any campaign tags in the page address.
• Google reCAPTCHA: a score indicating how likely a form submission is to be automated.
• Google Analytics, Microsoft Clarity and Google Ads: reports about how the site and our ads perform, where you have consented to those tools.
• Clutch.co: review data and profile information from our listing on Clutch.co.

3. How We Use Your Information

3.1 Responding to Inquiries and Consultation Requests

We use the information you provide to respond to your inquiries, assign an AI Architect to your request, and follow up with information relevant to your project needs. We aim to respond to all inquiries within 24 hours.

3.2 Sending Project Proposals and Scoping Documents

Where you have asked for a proposal or engaged in a consultation with MetaSys, we use your information to prepare and deliver fixed-price architecture proposals, scoping documents, and project materials relevant to your inquiry.

3.3 Understanding and Improving Our Website

We use site statistics to understand which pages are useful, fix technical problems, and improve performance. We use marketing source details to learn which campaigns produce genuine enquiries and where to spend our advertising budget. If you accept marketing cookies, Google Ads may also use your visit for ad personalization, as described in Section 5.

3.4 SMS and Text Message Communications

By providing your phone number on any MetaSys form and checking the SMS consent checkbox, you expressly consent to receive text messages (SMS) and WhatsApp messages from MetaSys at the phone number you provided. These messages may include:

• Follow-up communications regarding your inquiry or project
• Appointment reminders for scheduled consultation calls
• Project updates and status notifications
• Information about MetaSys services relevant to your inquiry

Message frequency will vary based on your engagement with MetaSys. Standard message and data rates may apply depending on your mobile carrier and plan.

You are not required to consent to SMS communications as a condition of receiving any service from MetaSys. You may opt out of SMS communications at any time by:

• Replying STOP to any text message from MetaSys
• Emailing hello@metasysltd.com with "Unsubscribe SMS" in the subject line
• Contacting us via WhatsApp and requesting removal

After opting out, you will receive one final confirmation message and no further SMS messages will be sent. To opt back in, you may reply START or resubmit your information through our website forms.

For help, reply HELP to any MetaSys text message or contact hello@metasysltd.com.

SMS consent and phone numbers collected for SMS communication purposes will not be shared with third parties or affiliates for marketing purposes. MetaSys does not sell your phone number, and it is used solely for communications related to your inquiry and our services.

3.5 Job Applications

We use applicant information only to assess your application for the role you applied for, contact you about it, and arrange interviews. Applications are reviewed by the MetaSys staff involved in hiring.

3.6 Newsletter

If you subscribe, we use your email address to let you know when we publish new articles. You can unsubscribe at any time by replying to any newsletter email or by emailing hello@metasysltd.com.

3.7 Keeping Our Site and Forms Secure

We use Google reCAPTCHA, rate limiting, and automated checks to block spam and abuse of our forms, and server logs to investigate security incidents.

3.8 Our Lawful Bases (UK and EU)

Under the UK GDPR and the EU GDPR we must have a lawful basis for each use of your personal data. These are the bases we rely on:

Where we rely on legitimate interests, we have weighed our interests against yours, and you can object at any time (see Section 8). You are not obliged to give us any personal data, but we cannot answer an enquiry or consider an application without the required fields.

We do not make decisions about you that have legal or similarly significant effects by automated means. reCAPTCHA scores are used only to filter spam; if a genuine submission is blocked, email us at hello@metasysltd.com and we will respond directly.

4. WhatsApp Communications

If you provide a WhatsApp number and check the SMS/WhatsApp consent checkbox on a MetaSys form, you consent to receive business communications from MetaSys via WhatsApp. These messages follow the same purposes and opt-out procedures described in Section 3.4 above. WhatsApp communications from MetaSys are limited to matters directly related to your inquiry, project, or ongoing engagement.

You may withdraw your WhatsApp consent at any time by contacting us at hello@metasysltd.com or by messaging us directly on WhatsApp to request removal.

5. Cookies and Similar Technologies

We only place strictly necessary items on your device unless you agree to more. Analytics and marketing cookies are not set, and the related scripts are not loaded, until you choose to allow them in our cookie banner. You can change or withdraw your choice at any time with the "Cookie preferences" link in the footer of every page. When you withdraw consent we stop the tools and delete the cookies they set on our domain.

5.1 What We Use

5.2 Consent-Based Tools

• Google Analytics 4 (Analytics): records page views and interactions such as form submissions and button clicks, with device, browser and approximate location details, using a pseudonymous cookie identifier. This is not anonymous data. We set Google Analytics to keep event data for 14 months.
• Microsoft Clarity (Analytics): records how visitors move, scroll and click on our pages as session recordings and heatmaps, so we can find and fix usability problems.
• Google Ads conversion measurement (Marketing): tells Google Ads when a visit from one of our ads leads to an enquiry or booking, and lets Google use that visit for ad personalization. We use Google Consent Mode v2: all Google consent signals start as denied, and the Google tag is not loaded at all until you allow Analytics or Marketing. See how Google uses information from sites that use its services.

You can also opt out of Google Analytics in every website by installing the Google Analytics Opt-out Browser Add-on.

5.3 Third-Party Services on Specific Pages

• Google reCAPTCHA v3 runs on pages that contain a form, to protect them from spam. It collects device and interaction information and sends it to Google. Its use is subject to the Google Privacy Policy and Terms of Service.
• Calendly loads its scheduling calendar on our Book a Consultation page. Calendly may set its own cookies inside the booking frame and is responsible for the data you enter there under its privacy notice. If you prefer not to use it, email us at hello@metasysltd.com to arrange a time.
• Images: some photographs on this site come from Unsplash, but they are delivered to your browser from our own website, so your browser does not contact Unsplash.

5.4 Managing Cookies in Your Browser

Most web browsers also let you block or delete cookies through their settings. Blocking strictly necessary storage may mean we ask for your cookie choices on every visit.

6. Data Sharing and Service Providers

MetaSys does not sell your personal data. We share personal data only with the affiliated MetaSys companies named in Section 1 and with service providers who help us run our website and business, under terms that require them to protect it:

• Vercel (United States): website hosting, security, Web Analytics and Speed Insights.
• Upstash (United States): the database that stores form submissions and our aggregated, cookieless site statistics.
• Resend (United States): delivers form submissions, including CVs and uploaded documents, by email to our team inbox at hello@metasysltd.com.
• Our business email provider: hosts the team inbox where form notifications are received.
• Google (United States): reCAPTCHA on forms; Google Analytics 4 and Google Ads only with your consent.
• Microsoft (United States): Clarity, only with your consent.
• Calendly (United States): consultation booking.
• RingCentral: text message delivery, only where you have consented to SMS.

If you accept marketing cookies, Google receives information about your visit for ad measurement and personalization. Under California law that can count as "sharing" personal information for cross-context behavioral advertising. You can opt out at any time by turning Marketing off in Cookie preferences.

We may also disclose your information where required by law, regulation, or court order, or to protect the rights, property, or safety of MetaSys, our clients, or others.

In the event of a merger, acquisition, or sale of all or a portion of MetaSys, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our website of any such change in ownership or use of your personal data.

7. Data Retention

We keep personal data only for as long as we need it for the purposes above or as the law requires:

• Enquiries, proposal requests, logistics leads and newsletter signups are stored in our database for up to 24 months from submission and then deleted automatically. We apply the same 24-month limit to the notification emails in our inbox. If you become a client, the records we need are kept as engagement data instead.
• Job applications, including CVs, are kept for up to 12 months from the date we receive them. Unsuccessful applications are deleted at the end of that period, or sooner if you ask. If you join MetaSys, your application becomes part of your employment record.
• Project and engagement data is retained for the duration of the engagement plus 5 years to comply with contractual and legal obligations.
• Newsletter subscriptions end when you unsubscribe. We keep a record of the unsubscribe so we do not email you again.
• SMS and WhatsApp consent records, including opt-outs, are kept as long as we need them to show that we respected your choice.
• First-party site statistics are daily aggregated counts with no personal identifiers and are kept for about 13 months.
• Google Analytics event data is kept for 14 months. Microsoft Clarity data is kept according to Microsoft's retention settings for Clarity.
• Security data: rate-limiting counters keyed to IP addresses expire within minutes. Our hosting provider keeps short-term request logs for security and troubleshooting.

You may ask us to delete your personal data at any time by emailing hello@metasysltd.com. We will respond within one month, subject to any legal obligations that require us to keep certain records.

8. Your Rights

Depending on where you live, you have rights over your personal data. You can exercise any of them free of charge.

Rights Under the UK GDPR and EU GDPR

If you are in the United Kingdom or the European Union, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your data in certain circumstances.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Portability: receive data you gave us in a structured, machine-readable format.
• Object: object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent: where we rely on consent (cookies, SMS and WhatsApp, newsletter), withdraw it at any time. This does not affect processing that took place before you withdrew.
• Complain: lodge a complaint with a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EU it is the authority in the country where you live or work. We would appreciate the chance to deal with your concern first.

Rights Under California Law (CCPA)

In the past 12 months we have collected the categories of personal information described in Section 2: identifiers (such as name, email address and phone number), professional and employment information (such as company details and job applications), internet activity on our website, and approximate location. We use them for the purposes in Section 3 and disclose them to the service providers in Section 6. If you are a California resident, you have the right to:

• Know and access the personal information we have collected about you and how we use it.
• Delete personal information we have collected from you, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing. We do not sell personal information. To opt out of sharing for cross-context behavioral advertising, turn Marketing off in Cookie preferences.
• Non-discrimination: we will not treat you differently for exercising your rights.

How to Exercise Your Rights

Email us at hello@metasysltd.com and tell us which right you want to use. We may need to verify your identity before acting on a request, usually by replying from the email address you gave us. We respond within one month under the UK and EU GDPR (we may extend this by up to two further months for complex requests, and will tell you if we do), and within 45 days for California requests. Cookie choices can be changed at any time through the "Cookie preferences" link in the footer.

9. Data Security

MetaSys implements technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission via TLS/HTTPS
• Access to stored form submissions limited to authorized MetaSys staff through a password-protected admin area
• Spam and abuse protection on every form, including rate limiting
• Regular security assessments of our infrastructure and third-party providers
• SOC 2-aligned practices applied to all client data handling

No method of data transmission over the internet or method of electronic storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.

In the event of a data breach that affects your personal data, we will notify the relevant regulator and affected individuals as required by applicable law, including notifying the regulator within 72 hours of becoming aware of the breach where the UK GDPR or EU GDPR requires it.

10. International Data Transfers

MetaSys has offices in the United States, the United Kingdom, and Pakistan, and the service providers listed in Section 6 are based in the United States. Your personal data may therefore be transferred to, stored in, or accessed from countries outside your own, including countries whose data protection laws differ from those where you live.

When we transfer personal data from the UK or the European Economic Area to a country without an adequacy decision, we use one of these safeguards:

• The European Commission's Standard Contractual Clauses (SCCs), and for UK data, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs
• The EU-U.S. Data Privacy Framework and its UK Extension, where the recipient is certified under it
• Adequacy decisions or UK adequacy regulations, where they apply

You can ask for more information about these safeguards by emailing hello@metasysltd.com.

11. Children's Privacy

MetaSys services are directed exclusively to businesses and professionals. Our website is not intended for individuals under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age.

If we become aware that we have collected personal data from an individual under 18, we will take immediate steps to delete that information. If you believe we may have collected data from a minor, please contact us at hello@metasysltd.com.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the services we offer. When we do, we will update the "Last Updated" date at the top of this page. If the changes are material, we will give additional notice on our website or by email, and where a change affects something you consented to, we will ask for your consent again.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or need to report a privacy concern, contact us at:

UK and EU residents can also complain to the UK Information Commissioner's Office at ico.org.uk or to the data protection authority in their own country, as described in Section 8.